mirror of
https://github.com/square/certigo.git
synced 2024-04-21 12:32:40 +00:00
92 lines
2.2 KiB
Go
92 lines
2.2 KiB
Go
/*-
|
|
* Copyright 2016 Square Inc.
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
* you may not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*/
|
|
|
|
package main
|
|
|
|
import (
|
|
"crypto/x509"
|
|
"fmt"
|
|
"io/ioutil"
|
|
"os"
|
|
"strings"
|
|
)
|
|
|
|
func caBundle(caPath string) *x509.CertPool {
|
|
if caPath == "" {
|
|
return nil
|
|
}
|
|
|
|
bundleBytes, err := ioutil.ReadFile(caPath)
|
|
if err != nil {
|
|
fmt.Fprintf(os.Stderr, "error reading CA bundle: %s\n", err)
|
|
os.Exit(1)
|
|
}
|
|
|
|
bundle := x509.NewCertPool()
|
|
bundle.AppendCertsFromPEM(bundleBytes)
|
|
return bundle
|
|
}
|
|
|
|
func verifyChain(certs []*x509.Certificate, dnsName, caPath string) {
|
|
intermediates := x509.NewCertPool()
|
|
for i := 1; i < len(certs); i++ {
|
|
intermediates.AddCert(certs[i])
|
|
}
|
|
|
|
opts := x509.VerifyOptions{
|
|
DNSName: dnsName,
|
|
Roots: caBundle(caPath),
|
|
Intermediates: intermediates,
|
|
}
|
|
|
|
chains, err := certs[0].Verify(opts)
|
|
if err != nil {
|
|
red.Printf("Failed to verify certificate chain:\n")
|
|
fmt.Printf("\t%s\n", err)
|
|
return
|
|
}
|
|
|
|
green.Printf("Server certificates appear to be valid (found %d chains):\n", len(chains))
|
|
for i, chain := range chains {
|
|
names := []string{}
|
|
for _, cert := range chain {
|
|
var name string
|
|
if cert.Subject.CommonName != "" {
|
|
name = cert.Subject.CommonName
|
|
} else {
|
|
name = fmt.Sprintf("Serial #%s", cert.SerialNumber.String())
|
|
}
|
|
|
|
if isSelfSigned(cert) {
|
|
name += green.SprintfFunc()(" [self-signed]")
|
|
}
|
|
|
|
for _, alg := range badSignatureAlgorithms {
|
|
if cert.SignatureAlgorithm == alg {
|
|
name += red.SprintfFunc()(" [%s]", alg.String())
|
|
break
|
|
}
|
|
}
|
|
names = append(names, name)
|
|
}
|
|
fmt.Printf("[%d] %s\n", i, strings.Join(names, "\n\t=> "))
|
|
}
|
|
}
|
|
|
|
func isSelfSigned(cert *x509.Certificate) bool {
|
|
return cert.CheckSignatureFrom(cert) == nil
|
|
}
|